New York University Stern School of Business

Vincent C. Ross Institute of Accounting Research

Sarbanes-Oxley Act Section 404:

The Impact on Business

May 2, 2005

The Sarbanes-Oxley Act [SOX] was signed into law in July 2002, with President Bush commenting, “We did not allow terrorists to undermine the economy, and we will not let fraud undermine it either”. Thus was the climate and undisguised anti-corporate sentiment that followed some of the most devastating corporate scandals in recent history. The Statute, which covers corporate governance, financial-reporting record-keeping and Standards is intended to restore investor confidence in our financial markets. Until the late 90’s the U.S. held the privileged position of being recognized by the world economy as having the most demanding financial-reporting standards providing transparency of information and full disclosure. The spate of scandals, personified by Enron and WorldCom, tarnished the image of corporate America both at home and abroad. The projected costs of recapturing our reputation and privileged global position, is currently estimated to be $35 billion-- the direct costs of implementing the Statute.

Section 404 of the Sarbanes-Oxley Act has been the cause of greatest concern both in terms of requirements, related costs, and the definition of material weakness. On May 2, 2005, The Vincent Ross Institute of the New York University Stern School of Business hosted a forum: “Sarbanes-Oxley Act Section 404: The Impact on Business.” A distinguished panel representing regulators, the accounting and legal professions, investment analysts, academe, the business community, as well as members of audit committees and boards of directors presented their findings on “The Impact of SOX”. Forum participants were privileged to hear first-hand accounts from individuals covering a broad spectrum of constituencies affected by SOX, in particular, Section 404.

What is Section 404? Mark Lilling (Audit Committee Consulting Team) presented a review and clarification of Section 404 (404), and a concise summary of the resulting fundamental changes.

Management is required to submit to the SEC, together with the annual financial reports, a report on “internal control” containing:

The responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting.
An assessment of the effectiveness of the internal control structure and procedures of the issuer.

External auditors are required to attest to, and report on, management’s assessment of internal controls. Their report must include:

A description of the testing of the internal control structure, the procedures used to implement the controls, and findings of such testing.
Provide reasonable assurance that structure and procedures permit preparation of financial reports in accordance with GAAP.
Description of material weaknesses and any material non-compliance.

Section 404 of SOX corresponds directly with the provisions of the Foreign Corrupt Practice Act [FCPA] whose Section 78m(b) (5) requires U. S. business to create and sustain adequate internal accounting controls to avoid financial statement fraud or misrepresentation. Evaluation by external auditors on internal controls has always been an integral part of the audit. What is new under 404 is the required external auditor’s report on internal control and public disclosure of any material weakness.

What constitutes a material weakness? How do we define material? When does an error in judgment or negligence become a “lie”—punishable by up to 25 years in jail? Douglas Carmichael (Chief auditor, PCAOB) outlined the major aspects of materiality, reminding the audience that conceptual definitions are inherently qualitative as well as quantitative.

· The definition of materiality in the evaluation of internal control follows the guidelines provided in SFAS No. 5 relating to recognition of contingencies in financial reports.

· The PCAOB followed the provisions of SAB 99 and SFAS No. 5 as frames of reference for Statement of Auditing Standard No. 2. The SEC regulation on 404 cross-references extant auditing literature.

· Significant deficiencies are a level below material weakness, and are not made public.

· The Standard permits substantial judgment on what has to be identified, documented, and tested.

Mr. Carmichael further stated that costs have skyrocketed due to the mechanical approach used by auditors. The current application by auditors is not upheld by the details of the Standard.

The PCAOB’s accusation of accounting firms’ increasing costs unnecessarily by employing “one size fits all” audits of internal controls, places the auditor in a “damned if you do, damned if you don’t” position. In the post Anderson era, there is an undeniable climate of distrust. The auditor must use judgment in deciding if a finding is a material weakness, a significant deficiency, etc. Furthermore, the auditor has been directed to use the guidelines set for in SFAS No. 5-- probable, reasonably possible, or remote—to assess the materiality of the weakness (if any). Given the tarnished image of the accounting profession and the climate of distrust—rule-based, rather than judgment-based audits were followed. We may not be able to draw a fine line between probable and reasonably possible. However, in today’s climate—litigation is certainly not remote.

Section 404: Costs, Benefits--will it prevent future Enrons[1]? Although the actual dollar amount of 404-related costs may be a subject of dispute, the panelists agreed that implementation has been prohibitively expensive. The distinguished panelists’ first-hand account of the perceived and actual benefits of 404, related from their experiences as Board and Audit Committee members, market analysts, auditors, and business professionals provided an interesting, educational, lively, and at times controversial Forum of ideas.

Abby Joseph Cohen (Chief US Portfolio Strategist, Goldman Sachs): From the perspective of a market analyst, representing the largest institutions around the world, Abby believes the costs of 404 are difficult to quantify. Even if the direct costs were quantifiable, the frictional (opportunity) costs of business that did not get done, the distractions, etc. were real--and cannot be quantified. However, she believes the frictional costs are short term; resources that were diverted to implementing the Statute are now being re-directed towards investment.

Some benefits are immediate and observable. Investors felt better after the announcement and subsequent implementation of the ACT, and as a result, the required equity-risk premium has declined. Although small companies are less likely to go public, in her view, this may be a positive factor. In her opinion, foreign companies’ threats of de-listing, are in fact politically motivated. They are concerned about the reach of the U.S. Congress, in what they believe to be, their sovereign areas.

The change in audit committee and governance structure, and the inclusion of financial experts on audit committees is critically important. Improved internal controls, as required by SOX, not only makes fraud more difficult, but helps maintain the integrity of the business model. Abby, in her ultimate wisdom, did not join the Enron et al “Bash Parade”. Rather, she concluded with a politically correct statement that drew chuckles from the audience. “Enron had bad attitude…some firms…inadvertent bad management…and accounting was considered an unnecessary evil.”

Lynn Turner (Glass, Lewis & Co.) shared his views related to the costs and benefits of 404 based on his experience with the SEC[2], from the perspective of his financial research firm, as a Board of Directors member,[3] and member of the Standards Advisory Group of the PCAOB. Mr. Turner shared his rather astonishing findings that financial managers in Fortune 11 companies had not received any training within the past 10 years on internal control procedures as specified by the FCPA. A troublesome finding from both a corporate governance and investor perspective.

Mr. Turner believes that the reported $35 billion cost should come as no surprise, given that firms have been remiss in their duties to date. The lack of internal controls has been instrumental in scandals where senior management have been taking company assets under the nose of the board of directors for their own use. The increased cost is also related to the costs of getting senior financial, executive, and operating officers involved—an important step from the corporate governance perspective. According to Mr. Turner, the number of CPA’s involved in management is, in some cases, nonexistent. The costs of implementing SOX is a drop in the bucket compared to what investors have lost as a result of restatements and scandals.

Raymond Beier (PricewaterhouseCoopers) and Thomas Knudsen (Ernst &Young) have found that above all, the “tone at the top” in corporations has changed. The resources required to eliminate deficiencies in systems design are being allocated. Major behavioral modification is making SOX work. There is greater accountability and appreciation of internal controls at all levels, and timely identification and remediation of deficiencies. Audit quality has improved as a result of more time spent on the audit functions. The benefits are, no doubt, more reliable financial reporting and therefore, greater investor confidence. However, there is a need for clarifying guidance for registrants, and regulator support of the use of reasoned judgment.

Marti Subrahmanyam, a professor of Finance and Economics at NYU Stern, also serves as a member of the Board of Directors of several large companies. Professor Subrahmanyam reported finding that audit committees have become more involved, and are not simply acting as oversight committees. The non-quantifiable indirect costs of implementation are non trivial, e.g. the cost of diverting finance people from other projects . The organizational charts are changing; CFO’s are insisting on enhanced direct control; the organization is becoming more efficient. The downside is that is increasingly more difficult to attract Board members. His firm belief is that the billions spent today will turn to benefits in the future.

Professor Eli Bartov (NYU) presented the findings of recent academic research on the economic consequences of complying with Section 404, and firm/auditor characteristics that may help identify Section 404 related problems. Stock price reactions to legislative events leading to the passage of the legislation were significantly negative. However, the final passage of SOX resulted in positive abnormal returns around the date the legislation was signed by President Bush. Material weakness in internal controls was more likely for firms with poor earnings quality, complex structures, or firms that were growing rapidly. Internal control deficiencies were significantly correlated with auditor tenure and fees rather than with the composition of the audit committee. Furthermore, the financial experience of management was an important determinant of the efficiency of the internal control system.

SOX—Size Large: What are the problems that small public firms, or firms considering going public are facing? James Feely (CFO,TDI) discussed the current concerns of his firm that had been moving in the direction of going public, but must currently rethink their plans. The projected costs of becoming SOX compliant for TDI would approximate 10% of after-tax income. Clearly, SOX has become a deterrent to small cap companies. Max & Erma’s has been called a poster child for SOX’s consequences (McTague, Barrons, 4/4/05).The chain is considering delisting to save 15 cents a share in SOX expenses, and avoid adding executive positions. The inability of small firms to absorb the direct costs or the diversion of senior management efforts may ultimately result in their selling out to large firms.

The case for Private Company GAAP is becoming stronger. The AICPA Private Company Financial Reporting Task Force reports, “key constituents’ thinking has shifted toward having different versions of GAAP for public and private companies”. Is this what we want? Do we really want to create the “great divide”?

There were two themes that permeated the Forum and on which there was total agreement. The direct costs of implementing Section 404 of the Sarbanes-Oxley Act are significant. They will decline but not disappear. The immediate, visible, and ongoing benefits of 404 pertain to changes in Board of Directors and Audit Committee composition, structure, and behavioral modification. Committee members are receiving reports before scheduled meetings, and are given time to review and prepare comments. They are taking their responsibility more seriously. They are thinking twice…before accepting positions. The prestige associated with being “a member of the Board” … is no longer cost free.

Will Section 404 prevent fraud? Seymour Jones (NYU) : The Ten Commandments didn’t succeed. The Foreign Corrupt Practices Didn’t Succeed. Can SOX do it? Bottom line--good internal controls will reduce the probability, but not eliminate the possibility of fraud.

[1] Although Enron was not alone, the name Enron has come to be symbolic of large corporate scandals.

[2] Chief Accountant SEC 1998-2001.

[3] Sun Microsystems